diff --git a/.github/workflows/daily-copilot-token-report.lock.yml b/.github/workflows/daily-copilot-token-report.lock.yml
index 4e3d6fab48..478ad5a542 100644
--- a/.github/workflows/daily-copilot-token-report.lock.yml
+++ b/.github/workflows/daily-copilot-token-report.lock.yml
@@ -306,6 +306,7 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: '1.25'
+          cache: false
       - name: Capture GOROOT for AWF chroot mode
         run: echo "GOROOT=$(go env GOROOT)" >> "$GITHUB_ENV"
       - name: Setup Node.js
diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml
index be25c20c88..f1245e653d 100644
--- a/.github/workflows/dead-code-remover.lock.yml
+++ b/.github/workflows/dead-code-remover.lock.yml
@@ -292,6 +292,7 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: '1.25'
+          cache: false
       - name: Capture GOROOT for AWF chroot mode
         run: echo "GOROOT=$(go env GOROOT)" >> "$GITHUB_ENV"
       - name: Create gh-aw temp directory
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index 7088380685..9b637b660f 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -721,6 +721,7 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: '1.25'
+          cache: false
       - name: Capture GOROOT for AWF chroot mode
         run: echo "GOROOT=$(go env GOROOT)" >> "$GITHUB_ENV"
       - name: Create gh-aw temp directory
diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml
index 02d5046db2..ac7f320bfd 100644
--- a/.github/workflows/smoke-codex.lock.yml
+++ b/.github/workflows/smoke-codex.lock.yml
@@ -353,6 +353,7 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: '1.25'
+          cache: false
       - name: Capture GOROOT for AWF chroot mode
         run: echo "GOROOT=$(go env GOROOT)" >> "$GITHUB_ENV"
       - name: Create gh-aw temp directory
diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml
index e81fa986f5..6ce0187fdd 100644
--- a/.github/workflows/smoke-copilot-arm.lock.yml
+++ b/.github/workflows/smoke-copilot-arm.lock.yml
@@ -387,6 +387,7 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: '1.25'
+          cache: false
       - name: Capture GOROOT for AWF chroot mode
         run: echo "GOROOT=$(go env GOROOT)" >> "$GITHUB_ENV"
       - name: Create gh-aw temp directory
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index 99b8b4911c..9f428272e4 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -390,6 +390,7 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: '1.25'
+          cache: false
       - name: Capture GOROOT for AWF chroot mode
         run: echo "GOROOT=$(go env GOROOT)" >> "$GITHUB_ENV"
       - name: Create gh-aw temp directory
diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml
index 8465c30e4a..6f5cbea6c0 100644
--- a/.github/workflows/smoke-test-tools.lock.yml
+++ b/.github/workflows/smoke-test-tools.lock.yml
@@ -318,6 +318,7 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: '1.24'
+          cache: false
       - name: Capture GOROOT for AWF chroot mode
         run: echo "GOROOT=$(go env GOROOT)" >> "$GITHUB_ENV"
       - name: Setup Java
diff --git a/pkg/workflow/runtime_definitions.go b/pkg/workflow/runtime_definitions.go
index 5b959182d7..426d53a6dc 100644
--- a/pkg/workflow/runtime_definitions.go
+++ b/pkg/workflow/runtime_definitions.go
@@ -77,6 +77,9 @@ var knownRuntimes = []*Runtime{
 		VersionField:   "go-version",
 		DefaultVersion: string(constants.DefaultGoVersion),
 		Commands:       []string{"go"},
+		ExtraWithFields: map[string]string{
+			"cache": "false", // Disable caching to prevent cache poisoning in agentic workflows
+		},
 	},
 	{
 		ID:             "haskell",
diff --git a/pkg/workflow/runtime_setup_test.go b/pkg/workflow/runtime_setup_test.go
index 1cbd7f9535..6efb454180 100644
--- a/pkg/workflow/runtime_setup_test.go
+++ b/pkg/workflow/runtime_setup_test.go
@@ -405,6 +405,7 @@ func TestGenerateRuntimeSetupSteps(t *testing.T) {
 				"Setup Go",
 				"actions/setup-go@",
 				"go-version: '1.22'",
+				"cache: false",
 				"Capture GOROOT for AWF chroot mode",
 			},
 		},
@@ -418,6 +419,7 @@ func TestGenerateRuntimeSetupSteps(t *testing.T) {
 				"Setup Go",
 				"actions/setup-go@",
 				"go-version: '1.25'",
+				"cache: false",
 				"Capture GOROOT for AWF chroot mode",
 			},
 		},
@@ -431,7 +433,7 @@ func TestGenerateRuntimeSetupSteps(t *testing.T) {
 				"Setup Go",
 				"actions/setup-go@",
 				"go-version-file: custom/go.mod",
-				"cache: true",
+				"cache: false",
 				"Capture GOROOT for AWF chroot mode",
 			},
 		},
diff --git a/pkg/workflow/runtime_step_generator.go b/pkg/workflow/runtime_step_generator.go
index 860142336b..73e437429d 100644
--- a/pkg/workflow/runtime_step_generator.go
+++ b/pkg/workflow/runtime_step_generator.go
@@ -101,7 +101,7 @@ func generateSetupStep(req *RuntimeRequirement) GitHubActionStep {
 	if runtime.ID == "go" && req.GoModFile != "" {
 		step = append(step, "        with:")
 		step = append(step, "          go-version-file: "+req.GoModFile)
-		step = append(step, "          cache: true")
+		step = append(step, "          cache: false") // Disable caching to prevent cache poisoning in agentic workflows
 		// Add any extra fields from user's setup step (sorted for stable output)
 		var extraKeys []string
 		for key := range req.ExtraFields {
diff --git a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden
index 3238645319..71318b2128 100644
--- a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden
+++ b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden
@@ -349,6 +349,7 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: '1.25'
+          cache: false
       - name: Capture GOROOT for AWF chroot mode
         run: echo "GOROOT=$(go env GOROOT)" >> "$GITHUB_ENV"
       - name: Create gh-aw temp directory